9d2821c2be03e8b324ef791a0bef23415b19809ce0c1f557b2b817dd5b1eda2d

Analysis

max time kernel
138s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PAPERIESS_lNVlTATl0N_VlEWER.msi
Size 744KB
Sample260804-yhs95adj5y
SHA256 9d2821c2be03e8b324ef791a0bef23415b19809ce0c1f557b2b817dd5b1eda2d
MD5 edce5a46a5b9b4c3749c3df367adf649
SHA1 8ec9faffbc2a2325a75dda33540c63731a3c3240
SHA512 43d5591a23cba26ccd385f0cec133b6d181cc625ffb9074daf901c6c9d88b0458d1cdb0c938b47e45f0fb3a35be0ed514195743a57329e6f3266939e2cb22055
SSDEEP 12288:sRsNW7ehwj4lkauPx5Ki7BvmZGRiTll0UlKLElxOqAXuiieFkgRuvxUSHwi7BvmC:syNW7nvUAW1lKwPOvfcvUnGJJulXvU
TLSH
T1EDF4CF117640C436C2B70A365669C6641A7EFC306E618A9B73C43F7EEE317C1AA24B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5824	Ninite.exe
3180	NiniteAgent.exe
3844	NiniteAgent.exe
4116	NiniteAgent.exe

Loads dropped DLL 6 IoCs

pid	Process
4304	MsiExec.exe
5824	Ninite.exe
5824	Ninite.exe
3844	NiniteAgent.exe
3844	NiniteAgent.exe
4116	NiniteAgent.exe

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2496	msiexec.exe
10	4304	MsiExec.exe
11	4304	MsiExec.exe
12	4304	MsiExec.exe
13	4304	MsiExec.exe
16	4304	MsiExec.exe
17	4304	MsiExec.exe
20	4304	MsiExec.exe
21	4304	MsiExec.exe
26	4304	MsiExec.exe

Checks for any installed AV software in registry 1 TTPs 3 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avg\Av	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop	NiniteAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879F	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DCFA8A6A40F33E8B34FE71DB3E9E5817	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E55FEB142F566DFBD0ED964FAB94545	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E55FEB142F566DFBD0ED964FAB94545	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DCFA8A6A40F33E8B34FE71DB3E9E5817	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\Desktop\desktop.ini	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D1BEC81CCAFDC823A062FF26A89A6B6D_59D467B487AF0C2E98F4DBDD6FCD324D	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D1BEC81CCAFDC823A062FF26A89A6B6D_59D467B487AF0C2E98F4DBDD6FCD324D	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7F163155784C838E248DC76B973A1804	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\Desktop	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE	Ninite.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA	NiniteAgent.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7F163155784C838E248DC76B973A1804	NiniteAgent.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe.8fcde64a-903d-11f1-b252-52abbeedcfd6.tmp	Ninite.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0181A3527FB163CA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB85A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE663D9DC3A865A93.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b0d8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4E15B1437538CCC0.TMP	msiexec.exe
File created	C:\Windows\Installer\{4F6F0B7C-6E7D-4314-9459-65FC0F92176C}\Ninite.ico	msiexec.exe
File created	C:\Windows\Installer\e59b0d8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{4F6F0B7C-6E7D-4314-9459-65FC0F92176C}\Ninite.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF458F0A9A4A64D7D3.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4F6F0B7C-6E7D-4314-9459-65FC0F92176C}	msiexec.exe
File created	C:\Windows\Installer\e59b0da.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2496	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ninite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NiniteAgent.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	Ninite.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Ninite.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Ninite.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	NiniteAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Ninite.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	NiniteAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	NiniteAgent.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\ProductIcon = "C:\\Windows\\Installer\\{4F6F0B7C-6E7D-4314-9459-65FC0F92176C}\\Ninite.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C7B0F6F4D7E64134499556CFF02971C6\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\PackageCode = "34C7FAC2EECDEC847A92D4B304DDAF36"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\SourceList\PackageName = "PAPERIESS_lNVlTATl0N_VlEWER.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C7B0F6F4D7E64134499556CFF02971C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\ProductName = "Ninite Agent (MSI)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1DF8C6E20882DF540936A70600F5391B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1DF8C6E20882DF540936A70600F5391B\C7B0F6F4D7E64134499556CFF02971C6	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C7B0F6F4D7E64134499556CFF02971C6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	Ninite.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	Ninite.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa4030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000005c0000000100000004000000000800002000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	Ninite.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc5c0000000100000004000000000800000b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	Ninite.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	msiexec.exe
2224	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2496	msiexec.exe
Token: SeSecurityPrivilege	2224	msiexec.exe
Token: SeCreateTokenPrivilege	2496	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2496	msiexec.exe
Token: SeLockMemoryPrivilege	2496	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2496	msiexec.exe
Token: SeMachineAccountPrivilege	2496	msiexec.exe
Token: SeTcbPrivilege	2496	msiexec.exe
Token: SeSecurityPrivilege	2496	msiexec.exe
Token: SeTakeOwnershipPrivilege	2496	msiexec.exe
Token: SeLoadDriverPrivilege	2496	msiexec.exe
Token: SeSystemProfilePrivilege	2496	msiexec.exe
Token: SeSystemtimePrivilege	2496	msiexec.exe
Token: SeProfSingleProcessPrivilege	2496	msiexec.exe
Token: SeIncBasePriorityPrivilege	2496	msiexec.exe
Token: SeCreatePagefilePrivilege	2496	msiexec.exe
Token: SeCreatePermanentPrivilege	2496	msiexec.exe
Token: SeBackupPrivilege	2496	msiexec.exe
Token: SeRestorePrivilege	2496	msiexec.exe
Token: SeShutdownPrivilege	2496	msiexec.exe
Token: SeDebugPrivilege	2496	msiexec.exe
Token: SeAuditPrivilege	2496	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2496	msiexec.exe
Token: SeChangeNotifyPrivilege	2496	msiexec.exe
Token: SeRemoteShutdownPrivilege	2496	msiexec.exe
Token: SeUndockPrivilege	2496	msiexec.exe
Token: SeSyncAgentPrivilege	2496	msiexec.exe
Token: SeEnableDelegationPrivilege	2496	msiexec.exe
Token: SeManageVolumePrivilege	2496	msiexec.exe
Token: SeImpersonatePrivilege	2496	msiexec.exe
Token: SeCreateGlobalPrivilege	2496	msiexec.exe
Token: SeBackupPrivilege	2772	vssvc.exe
Token: SeRestorePrivilege	2772	vssvc.exe
Token: SeAuditPrivilege	2772	vssvc.exe
Token: SeBackupPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe
Token: SeTakeOwnershipPrivilege	2224	msiexec.exe
Token: SeRestorePrivilege	2224	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2496	msiexec.exe
2496	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2496	msiexec.exe
2224	msiexec.exe
4304	MsiExec.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2604	2224	msiexec.exe	94
PID 2224 wrote to memory of 4304	2224	msiexec.exe	96
PID 4304 wrote to memory of 5824	4304	MsiExec.exe	98
PID 3180 wrote to memory of 3844	3180	NiniteAgent.exe	100
PID 3844 wrote to memory of 4116	3844	NiniteAgent.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\PAPERIESS_lNVlTATl0N_VlEWER.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2496

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C2A587C4E607DB081684FBB4D23EA592 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Users\Admin\AppData\Local\Temp\6ab198fb-903d-11f1-b252-52abbeedcfd6\Ninite.exe
    "C:\Users\Admin\AppData\Local\Temp\6ab198fb-903d-11f1-b252-52abbeedcfd6\Ninite.exe" /install msi /silent "C:\Users\Admin\AppData\Local\Temp\6ab198fb-903d-11f1-b252-52abbeedcfd6\Ninite.exe.report.txt"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    PID:5824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
"C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /stub:service /stub:subdomain remote /agent
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
  "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /stub:child 3180 00000230 "NiniteAgent" /stub:subdomain "remote" "/agent"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
    "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 3844 00000A80 00000A6C /override 75e8becdcb76b2afe5d874bb57b6f7424c71da6b /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1537\Ninite.dll" /audit /silent /nocache /data a5422e35-903d-11f1-b252-52abbeedcfd6
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:4116
- - C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe
    "C:\Program Files (x86)\Ninite Agent\NiniteAgent.exe" /slave 3844 00000A80 00000A6C /override 75e8becdcb76b2afe5d874bb57b6f7424c71da6b /rundll "C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1537\Ninite.dll" /audit /silent /nocache /data b122a832-903d-11f1-b252-52abbeedcfd6
    3⤵
    PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b0d9.rbs

Path C:\Config.Msi\e59b0d9.rbs
Size 7KB
SHA256 025f06a1ca834931f983d473c7bb8b3ba04886b28e5b126a078a0beb8e40c4a1
MD5 ba3abf20a42b7bff4f4e89ac4fdfea79
SHA1 fdd8dd55d3012bd73f5714d44b9f6a4e4633a855
SHA512 75ce1af31eca3f0552ab641834b083cf6a6d1cf5e09f6b13b2e5d33416c5e45594c579aa6ce42c1fc89a49267a180940635a8dc75906e5e43e5f08e625684ae8
SSDEEP 96:2d2sCfV11UTYXTCsThqhUTYXTC6j5ScRMwAThqUHPq15N4vTy6rcBxCBTbplj5SL:21C3OkXOIfkXONkULTlbp+
TLSH
T14BF10F867600C2D3E8E70B34C707177A37A7E3A5E234135708DD99241F86B9D2E9B29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ninite.exe

Path C:\Users\Admin\AppData\Local\Temp\6ab198fb-903d-11f1-b252-52abbeedcfd6\Ninite.exe
Size 414KB
SHA256 d77908d441d511c81cbbc991feec5d464873a78865b13e50eed8a039683d7f72
MD5 1a2dfde9ecce125bb104e216093629b4
SHA1 acc3286d2898e9a6a6701e581985797314347adc
SHA512 f73eb0a5f666e1013ff99a065f665e874d7b1698fda8ececd663f8002b5032b40e234b44d813019473eef271ce9a7e0606b2f4b3a985f750f4dffe45852d9fdf
SSDEEP 12288:JRiTll0UlKLElxOqAXuiieFkgRuvxUSHwi7BvmZnN8RJB:TW1lKwPOvfcvUnGJB
TLSH
T1F994AE117685C437D2B30A335669D26919BDB8317D618A9BB3C41BBEED307C2AA10F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ninite.exe.report.txt

Path C:\Users\Admin\AppData\Local\Temp\6ab198fb-903d-11f1-b252-52abbeedcfd6\Ninite.exe.report.txt
Size 2B
SHA256 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
MD5 e0aa021e21dddbd6d8cecec71e9cf564
SHA1 9ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA512 900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
MD5 SHA1 SHA512

Submit Download

Ninite.dll

Path C:\Users\Admin\AppData\Local\Temp\7639014b-903d-11f1-b252-52abbeedcfd6\Ninite.dll
Size 414KB
SHA256 16f1b6883b73a758a1959a4e3b0cba5bee03f2fa45e451f941afa168f54ad938
MD5 c44b6c52d403ff8331dc796426617c94
SHA1 5776c5f469792f20adc4ea620c2e8e5c81d08aeb
SHA512 7f38773f235b2063a509b1f39cb385721504d872d035eb92add21b19b41144076f26118f070058187696ab7c1739c45ee404a8963aee9ca5a7a26261c0193a82
SSDEEP 6144:JB7Eeseb9MhRERxf4xFj8kCnl8aeNPCR+JOhlMi7ksvmacD54Buf:JBaeZzf4xFj8EPnBi7BvmZD5cW
TLSH
T15994AD21F9458436D66F06303528DA651D7DBC717FE0D9CBA3C01DAEA9726C0EB24B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ninite.dll

Path C:\Users\Admin\AppData\Local\Temp\Ninite.tmp\7ffba6c0-903d-11f1-b252-52abbeedcfd6\Ninite.dll
Size 850KB
SHA256 15646217deb09ed9e91b28584b498f1be4745906e8aeef937539ce877c9d5edd
MD5 a77a8efb26adff1593e851ae3876a35d
SHA1 78af199d7c4c89d3e94751f731d68209bedf7c44
SHA512 776383ffe57fcb9d3cfb0b4efb03c46e0ce9d8a8319c9a0f05efce4f8455193d4aca07aa91666ec92bec9b4fb5f7982271f48675ac84de85ce8ebc32b767ec03
SSDEEP 12288:a2FiA+4qKllVh804Mq4MaL1hIvVZlc7IvVulTmkISbgJ7wTai7BvmZj3Gbfld9TX:NFiA++ovLlbvTkISbgmTfvUj2Tld9TX
TLSH
T1F7057C237A89C03AF17E0270652D977918B5EC304AB195CB77C477AE2A74BC0A729F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB85A.tmp

Path C:\Windows\Installer\MSIB85A.tmp
Size 637KB
SHA256 dbda294c39231d7b33cfcd533fd4af4615628a48b4856000d1d5d0df8806d160
MD5 3dd49c161cf90983c9b9c21ccbd91a34
SHA1 dfc21d1238812ece2ec2c4f213f65680718a2726
SHA512 99f17b8af0870331869c7513ac660b92903bf5cfd301e1824197519015ac666625243d33af3a40eaec422edda425662e23e89d08fd01fd8896d013445efede50
SSDEEP 12288:/RsNW7ehwj4lkauPx5Ki7BvmZGRiTll0UlKLElxOqAXuiieFkgRuvxUSHwi7Bvm9:/yNW7nvUAW1lKwPOvfcvUnGJJul
TLSH
T184D4CF117680C436C2770A365668D2651A7EFC306E618A9B73D42F7EEE317C1AA24F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 1KB
SHA256 ab2a480b1cfbcd5a49d62cf35f0b7fa8961726ca3ddc23d5a2714de84d5910a4
MD5 1776aa8a256619817a2df02043b6e0f1
SHA1 863fa4bfaf8b041f7d01709d5047cb3ab649dac4
SHA512 84e38f6f11a2de7febc9b248fc7a2fa05fc79dd59cc0206f0b5c843c85f1d86487b0e79b876758ee5768815028f98e8d23759f4b1f4b22ed0371ed4c8a23a2aa
TLSH
T14A2199F26F68A9A0AE917F9858ECC5377D3071D8B9E14D22D93244B22C893B31B4D05F
MD5 SHA1 SHA512 TLSH

Submit Download

8E55FEB142F566DFBD0ED964FAB94545

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8E55FEB142F566DFBD0ED964FAB94545
Size 8KB
SHA256 0f2cd52a46c8d23d17680c5cf6d088c4d9d3b9650177a6acef042447109b49a9
MD5 ef742b46ba1e5b67c2c1bc9c60de08a0
SHA1 259f87376b46365c3488ed1d29b7856e650598a1
SHA512 b053c8076d75de5e7a37fab4c33167eaec9278c37cce6ee2536f818a18ca341c90fa8ea88590a05b112b1dda2f5d81874c1a7c65e52c9c563e743f2b4834988f
SSDEEP 192:EXtnCJolZe5V3IFfaTLHke1sXk3SPykBUMljvwFM:EXtblZe5V3gfaTLkSSUsjY2
TLSH
T1670253D1AFBD2CA4F689CFB200CD9A2F677375DA76031A4056F85A90E9067C11F3D424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 1KB
SHA256 ca63fb09551e6cdc07857f9b483b5c64b56d55e29aa7c2f29c4830ea9cf96bca
MD5 f4269eee2315c5de814954d67d497f26
SHA1 fe4ae43eae286d427eddcd3e2a92eed7ac658d2f
SHA512 014dc4b67c8529c8d691d36dac70a5071706a8bee81142eabbb67b7db7fcf51a62f23a2940f20194b9edb81ec53d5a8162d81dabc0ac9b166b01553ee669f15c
TLSH
T12331D6374F6CAC518F118C9029DAFE377861C5E41DA9207B7128962A24C07B24F1591F
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232
Size 1KB
SHA256 f1e8b1f387dd138bef25d8b0ba54de3e0867056b7c8d53d18f392f287d9ef5be
MD5 b27d0f2a041dc4c39642a30c27aa55c4
SHA1 9aacb5455cb0e49b2a2adbbed959e1fe1af9bced
SHA512 8d8f3235359859d9665f20b6b270fca02960ffc5ed56207c654da224c2515a8d32888bf393901087e15771a08387dc814c18111d5df66fc1880e90d5c2c79de2
TLSH
T1E731F82F063532037B025E9869E99E333CB03BE5C5E9F82FE6BE101845603B24E59949
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4
Size 1KB
SHA256 9744665df0d81ed362b6652e9d846d0a93615414f0c31d5a2f0c06698ef2b873
MD5 31730d0c7be8c25226439d304747261b
SHA1 7585a9eaf81b7dc9a62f8310a92b47f6c9d1409e
SHA512 255fa33959316fa4d45192921bb89f0368a099150f1c3a7a50e9219e2683195db571f15759092eb3f93b5cdc2145be63289a0a8243dae43a88a92d137848f2da
TLSH
T10B2174AB5AFD4CC7AB16CEA906DDD1B32CA1D6E414CC1489F10BC271B80139A2E9612C
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 1KB
SHA256 f4c53e62119cdd2333dc2cf7be625ae6ed08bea452f5588452c600ca529a9529
MD5 58f694823da53ecd1b61ee1358dd27cd
SHA1 004ee3a647ba604bf96a27d7eeb801a12d621bab
SHA512 45404ac9506b2b97219b0145774c6930b66030d3e81c8f4b9c375579a3d7d1468c18c406fc92e60c00531e786c9f8416eeb949b33daefcc4807f3f22429f35c7
TLSH
T1E021E99BAAB8AC862F019E440ECCE3763CB5E7D504CC040AF20BC2792D0239A2E5103D
MD5 SHA1 SHA512 TLSH

Submit Download

B0B1E3C3B1330A269DBEE4BA6313E7B4

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B0B1E3C3B1330A269DBEE4BA6313E7B4
Size 1KB
SHA256 dd12c5733bc4b682e1da6353c8c27650f53d11a8ada8fd8a2d06f23cecae5ebd
MD5 2ffbdb98df2a2b022a48adeb94a3af50
SHA1 6c86923b5c5832bb102f041cb7d38db397074f12
SHA512 a5f29661ac78ea205dd945fcc53e015152277426af4bcce688231ca1a564dc49144b2953409651737733fec72e9042468c780917543c007d7de74ed44058dbfb
TLSH
T1073145968E7D3C55E3139DB0C6CFED6B9E30E4C617C1AC2A523896805581FC24EF4494
MD5 SHA1 SHA512 TLSH

Submit Download

BCB67D7ECB470284AF35679F339E879F

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BCB67D7ECB470284AF35679F339E879F
Size 713B
SHA256 0cdc5d8b874c058efea52f5e370cd6b6f4dcf4c880812fb82696e1723242eaf1
MD5 3da54864ee51a020c52b8c403fe4f27a
SHA1 957e0434ac5a931c815e17f57b3f2ba96f42682a
SHA512 2b2d112825d1a25f6888515d5d67798d0a513c892aa817fa2c897840e727c35bd22fde9edb4b70e871d90c1fcb685c339bffa339d5dc82853fbc99163a72682f
TLSH
T1E90144700504B1716FC3BE756FCBCAABCDB643D06594981690924B8A1461BEC6DC601A
MD5 SHA1 SHA512 TLSH

Submit Download

DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 215ebf14929ad38ac9a6347e16ea10fef3963b851ccc34008463fa1392513377
MD5 436552e5c9a76cf568684155ff116e17
SHA1 0ffb4309688b9bef342b16c8ae58052b33449b04
SHA512 ee2b9be41a4e3e96878c0d80c6a18b48768d899b647cde95e70aa88cc207c9a3a01f2236c6230c2bdd6e1e5b02e2efa21dcc10524b01d23df987b2cec3494301
TLSH
T1A2C08C5023F58240F1318E7E3F112AA297765D069902C3100F24030C8468B000C62E07
MD5 SHA1 SHA512 TLSH

Submit Download

75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8
Size 438B
SHA256 2bcd5790858afe65953b5c1f06e3f9bb8d48574f443d92f05a236e64fa61517e
MD5 ea010476f481c7e8b4f3a157999bb538
SHA1 dc3a2e3943fbda94046bd1e7a24b2c7c82ea2b0a
SHA512 56b63184caf0a9910a7cd310fc375a4b5afe7b5cb7389ca68fc4d2142d88eee3d22b79e1640e790efbee04fa2fd08a94f567425856bf9f5183daf5912b8124e1
TLSH
T14CF06874ABFF822DF533E9B507DD67208866F2338840A3B807B412186381D829D23A17
MD5 SHA1 SHA512 TLSH

Submit Download

769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\769F85394FB15C375FF89A7488274D5B_042FC0BE139F72196A338B07721E6413
Size 440B
SHA256 3e59900e1de8a8d9e7edb858067dc36f782914916330eb3b43d9463f93494fd6
MD5 deb8027e85d61b852d9551257bf988ed
SHA1 fb7a2ee4570e4a9d67afe2522450cadd7375ed29
SHA512 57b52e791fc9398f21b198741b250ecab8e79ba5dae79e45ed49dcd680e2f424a48b33c1d9edae09eed852ec50257b9a3e31b3070f4656b68b12857a67725bdb
TLSH
T100F0D81C3ABB000CF065EE7827C171725AA9E912184956A61A944309AEA5D00ED30A33
MD5 SHA1 SHA512 TLSH

Submit Download

8E55FEB142F566DFBD0ED964FAB94545

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8E55FEB142F566DFBD0ED964FAB94545
Size 210B
SHA256 5ad2a5f50541e39f5653af94941a3883051a1e00ec72d8c266eabca345d920eb
MD5 93e1f74949626ee1d2374e1298fad806
SHA1 cfcd0f15bbdee1d531158b8f4dd4081a666adaa8
SHA512 79c96ff7e6db082973e23b546e368fafb9688bf194376917774362d7ee2eab6911488470206aae1b4ce8762e3ff95f9b934dd3ec009bb45ef43ab7d6c30f1805
TLSH
T14BD04C402778460CF07A5E3F7C5251925AA6EE109C928329066811484879E01CD35E66
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
Size 532B
SHA256 71732c697c060efefb78c25e8b13b38d2f45fc777a44244f82227b15e130e7ae
MD5 e255291c014038f985557c8d7820fed2
SHA1 f91593bd0f01e6a6cd8f7207813bd47c402a6420
SHA512 c171db7b3a9acbfc9a436e770d74f4919ee303e038a78e75539778b534ddbc227f9b3cd5f1d8c0fe1f4279a69187a5e0e8dfc4a4aac8aa5e6627a1ed2f7ca22b
TLSH
T1EAF0DC1851F4510EF837DEB82DE8B510E856F90118615ABD0395070E8D31F00ED1343B
MD5 SHA1 SHA512 TLSH

Submit Download

A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_9877C66D01D477FB94AD0B5E73090232
Size 544B
SHA256 5fde28fd37e82191fa13e0c074e0d7e787213e422f00c40b4c406ad4276637b7
MD5 000f4f6e333159bce88b9d9e5098d6c5
SHA1 e029943cdf5dd5341cb5e8dde7d7b5558c525a61
SHA512 73674b2f7faa5f66f5b78640a4d0fb43cec4104f055f88ebf225263be571815bf3041e13e2cc0edc25a657d96e7c57e96a5300a8f2428797fabbbdf03f8229af
TLSH
T183F09E2C1CF6403DF137D9BD16D0A0A18E25FD271C4186E90FE1470E6811F08BC23639
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_4BB72A60CF9C652B353353202101C0E4
Size 502B
SHA256 a2fca21a0dd8be50036fe8210533a56eac9434b5fec0efcd954fec6ad1c32737
MD5 54f6b991fc4bd0a13ddaf5361b5dd24e
SHA1 d5a819b4f46624b88ecf85053f117ccd09fc09e8
SHA512 59c003c311ff4047c0880df21799651bf89fe48719b006c6127cfcf966468268d772bab7a563192ab85524351b5dc42e92580c72eb2a4e2e66c473f5213bc057
TLSH
T182F05C1455F4A03CF133DEB4B1C621F2AA96F912341456FD06AE47086A68E511C9153C
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
Size 508B
SHA256 a878aabb4c253cf85b2f7ea30a96b4ad52de9729e4b91a6839ba609643f8cdc2
MD5 e45754a3dd49ba3d23b007a8e459e9f0
SHA1 569d58842678117a5597ae418b1034e6949aeebd
SHA512 baa98ab3372e52ef226b89af52b84ba15d6c23d67d0a58ef10d8e72d18e2143af911668426ea546d5b17748039cca809f0a38297c437d1668be726db1d29f0f6
TLSH
T1ADF0EC1464F8A01DF1B3DE7496E962F6661FFD03385456FD067943085725A406C41538
MD5 SHA1 SHA512 TLSH

Submit Download

B0B1E3C3B1330A269DBEE4BA6313E7B4

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B0B1E3C3B1330A269DBEE4BA6313E7B4
Size 208B
SHA256 260bd04cd92bcada7503d2fb8c7da902572d7029cac79aa230d770f983e28315
MD5 83b26884517982345118ffba757392cf
SHA1 763cd93612efedbb0631fbda6196f7db84c1e469
SHA512 4414f514e9d13c22f300489081676971b031b0eef077da3723ea3bc5c782a537b5b4273e4c00ed10467b8a2622bc23d40a76c537d120084115788fd5f33d06a9
TLSH
T1ADD09B006B66475CF1754F7E3D5357525FE1ED208853C355073811689C78D408D75E3D
MD5 SHA1 SHA512 TLSH

Submit Download

BCB67D7ECB470284AF35679F339E879F

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BCB67D7ECB470284AF35679F339E879F
Size 276B
SHA256 6ca97e5cb5ccbad6ff6666ba28abd8680add35d594225ba6ff66519cb306fcab
MD5 6c1371498da2d763934dcc1649cb4912
SHA1 46565584ef8710fbd214579f6531e0060197b2be
SHA512 e1bbf3493f85d6954b27203d6a9e251bddc7d3f706ae0f9aa914012f90d82045cb8413a978b076849d89fb4d4caa3ff084156623be6b3bb97f05eff6315d54b8
TLSH
T15CD0A7685BBC1307F032C6B699985D41DA32A445A251C71C0BBD168C5864F646C32F0F
MD5 SHA1 SHA512 TLSH

Submit Download

DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDA81A73291E20E6ACF6CACA76D5C942_1A3F29BC2FD4D54C7B2AF1BE78C1E8BE
Size 436B
SHA256 ebdcf2a91509070a9172e836a7352bff3e73648da5af506470b33ac0b8f19aab
MD5 9ea0a33b2aeff6b3f71af12fd6a0fa8c
SHA1 a6a6273df912266b6a98c083616849d50e82132f
SHA512 7b1d9295fd010b464b0c88e12c4691873622f1e73e3bf0d954ed77cececdb1c0006bfd6efc816314def46634290f298d4fface722b6a2e8ab9ae499ce37d47bd
TLSH
T12EE026182BBA011CF039ED392BCAB321556FDD172C152BB83AD493097972C00ADB2B39
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
Size 174B
SHA256 768b6fde6149d9ebbed1e339a72e8cc8c535e5c61d7c82752f7dff50923b7aed
MD5 17d5d0735deaa1fb4b41a7c406763c0a
SHA1 584e4be752bb0f1f01e1088000fdb80f88c6cae0
SHA512 a521e578903f33f9f4c3ebb51b6baa52c69435cb1f9cb2ce9db315a23d53345de4a75668096b14af83a867abc79e0afa1b12f719294ebba94da6ad1effc8b0a3
TLSH
T19FC08C2CD2E932204172CD32BCB4A002DBB1F8212C1BCF9E06C0918B08A1E09FB32B43
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Size 174B
SHA256 8e00a24ae458effe00a55344f7f34189b4594613284745ff7d406856a196c531
MD5 a2d31a04bc38eeac22fca3e30508ba47
SHA1 9b7c7a42c831fcd77e77ade6d3d6f033f76893d2
SHA512 ed8233d515d44f79431bb61a4df7d09f44d33ac09279d4a0028d11319d1f82fc923ebbc6c2d76ca6f48c0a90b6080aa2ea91ff043690cc1e3a15576cf62a39a6
TLSH
T1A6C08028D2E9311041718D32BC749002DBB1F4213C17CF5E16C0518F04A0605E732743
MD5 SHA1 SHA512 TLSH

Submit Download

Ninite.dll

Path C:\Windows\TEMP\Ninite.tmp\58A3B1F61C5EED34F8F3BE51B5CCB87428995490\1537\Ninite.dll
Size 1.7MB
SHA256 c63fd2680fa7bbb6b7736257dd8d995e4ca2d0db1bf1d9909da9a1eff85068cd
MD5 780a9399146febdaf770c03b4b68a1bf
SHA1 caff092f1ca05755d3eab3e7edf88096ebcba12e
SHA512 e112151a9495f3943e5338037eef5da9fdc86064ee0668c03d87139d841fb7869633716da28036d4472aa49633a5f14f4144f9d4fb92847df672c3871702efb2
SSDEEP 49152:/FyJS7/8jVM1OAHmOp0fYrpH5wwhEFqfeI/t9UEDWqkL1o0hRS8K:/Fh7EjVqOhOp0foytFqoEDn
TLSH
T18F858E23B699C439E07E0270752C97552AB6FC304A72C49B77D03B8E79B8BC1A625F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NiniteAgent.log

Path C:\Windows\TEMP\NiniteAgent.log
Size 86B
SHA256 009fed6972325246a8884e379196de35203aad4512cae30bd0b80e1929ff21f2
MD5 be56b7c803bb8afa23a1b7ecfc458e8c
SHA1 f52833a4cb430c36e0ec8618d9695daa3fb8e05a
SHA512 350933388adaae17717d724753ff9e72183a8d3ce3a634550f05dbfc70d3346fb4710b9c11d1e659bdd3fd51b13f98a1c6bab3bc96f8f2f15f8abf7c5ae4b966
TLSH
T12FA0122080F601102D5300D8D50745081107FA2B350404C07330123058E7140865A85E
MD5 SHA1 SHA512 TLSH

Submit Download

^641283C7409549432490C865E671E40861A802D0

Path C:\Windows\Temp\Ninite.tmp\^641283C7409549432490C865E671E40861A802D0
Size 81B
SHA256 d626e706fb0ae9b1836eae9c7d2aaa41af6503a3ba4c739385a4130f8df441ff
MD5 174ed32f1419d2633835ab626501923c
SHA1 f1a750b74a608a844776117fe0a8ec5c0bf25699
SHA512 f7147ed762fff07d404f2fd00edf3636778fba7397d4e23c29b363b04065222681b30922b45d9b8b1cf86e45a2eca182cac55894711c4cc7ec417009e707bbed
TLSH
T1E2A012C0B62C49420161CF0444D150C100C81280098601296C0014E1D42041C108DB70
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 fe2346253fc076487bbcaec25fcc5e3c272e2e2fe31e55ca29770328ae0edecf
MD5 921751351a69244883a5a4c39d972949
SHA1 9c61208321fc8ea17b7f0f3fd44f821229a75c34
SHA512 e899cb73c712132bc3520801b3d36f24cbd15a68c6233b70c843a388d6658e070f268580960a94ed307e86ba35e5984c2ce71cbc1456995d1a84ffc57d744909
SSDEEP 24576:bFo3DMPJdoO/vvTL/yAjDilQP7eJY7Eg0+1xNudb1WtqJESTsIRmD6pin+z:nHI
TLSH
T13257B31436F92200E7B79E3DB8F06A234D397D5BAC15DE8D45511B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{da6b58ca-831a-4717-a0d1-df9ad1d0e05f}_OnDiskSnapshotProp

Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{da6b58ca-831a-4717-a0d1-df9ad1d0e05f}_OnDiskSnapshotProp
Size 6KB
SHA256 d48555f0d0a136102f8b64bca685d68191b0ffec249421209d35c586d790c660
MD5 16cdc2ae0591973b4f105384f0b3540b
SHA1 5673baa7be7a21fef6b0dd75fafa861a319627fe
SHA512 5447b5eb278c566387cb1d4bd71e9cd8331ed5ba49e3486f70deae37f0022f19895ed0844ed89a760bdeca51f1dceda0662b26969ce630298bfce7ae6f8d12d0
SSDEEP 96:Fz0ILb/vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:SILb++uVm
TLSH
T1E7D189085AF54311E2B3AB3128F14557A877B911EF33CB8E0198238E6671A11F975F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download